Date: Thu, 20 May 2004 20:03:58 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: freebsd-questions@freebsd.org Subject: Re: netstat output - diff between 'link' and 'inet' counters Message-ID: <20040520190358.GA10740@happy-idiot-talk.infracaninophile.co.uk> In-Reply-To: <20040520172301.GB3534@gentoo-npk.bmp.ub> References: <20040520172301.GB3534@gentoo-npk.bmp.ub>
next in thread | previous in thread | raw e-mail | index | archive | help
--6TrnltStXW4iwmi0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Thu, May 20, 2004 at 11:23:01AM -0600, Nathan Kinkade wrote:
> I delved into trying to determine the cause of an unreasonably high
> number of Ierrs on a few FreeBSD routers we have setup on campus. While
> probing through the netstat output on the machines I realized that I
> don't understand the exact difference between the 'inet' and 'link'
> protocol families. Now, I understand the difference between IP and
> ethernet, but the byte and packet counts for 'inet' and 'link' don't
> seem to match what I would expect for those protocols, respectively.
> This tells me that the numbers being logged must differ from my
> expectations. Generally I notice that the 'inet' counts for an
> interface are a relatively small fraction of that for the 'link'
> counts for the same interface. However, on our main FreeBSD router that
> provides NAT and access to the internet the numbers are somewhat
> reversed, with 'inet' counts being much higher than the 'link' counts.
> Is there someone who can explain to me exactly what packet and byte
> counts actually represent for the 'inet' and 'link' families?
I surmise that you're talking about the per-interface statistics as
reported by 'netstat -i' or 'netstat -I ifN' rather than any other set
of flags to netstat. Let's look at what I get on my system:
% netstat -I de0
Name Mtu Network Address Ipkts Ierrs Opkts Oer=
rs Coll
de0 1500 <Link#1> 00:40:05:a5:8d:b7 149504 0 111734 4=
0
de0 1500 81.2.69.216/2 smtp 70771 - 120940 -=
-
de0 1500 fe80:1::240 fe80:1::240:5ff:f 0 - 3 -=
-
de0 1500 81.2.69.219/3 arbitrary 371042 - 301860 -=
-
Now, link#1 corresponds to my local network (from 'netstat -r'):
81.2.69.216/29 link#1 UC 2 0 de0
So the Ipkts count is for all the packets passing that interface with
a destination address matching the 81.2.69.216/29 network but not
including packets to one of the specific addresses on that
interface. That includes many packets for some unused addesses out of
my netblock[*] and also packets to the broadcast address 81.2.69.219
The other three entries are for the specific addresses assigned to
that interface -- I have the principal IP number on the interface as
81.2.69.218, and a jail using 81.2.69.219, plus the automatically
assigned IPv6 link-local address. (IPv6 traffic mostly goes via a
gif(4) tunnel which acts like a different interface.
Cheers,
Matthew
[*] It's a feature of the way my network is set up that all such
packets will hit the de0 interface of that machine. Normally a
network switch will prevent irrelevant traffic from hitting that
network interface.
--=20
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
--6TrnltStXW4iwmi0
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
iD8DBQFArQEeiD657aJF7eIRAgL0AJ4xEkwbJvz7n4QNsf93p19UELlbxACdG0sT
pgnRwEY5nIxOaTtZfVoduTo=
=0v0X
-----END PGP SIGNATURE-----
--6TrnltStXW4iwmi0--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040520190358.GA10740>